REvil Victim Claims Raise Questions About Ransomware Targeting of Military-Linked Suppliers
Summary
DarkOwl says REvil’s latest victim announcements point to possible targeting of suppliers linked to military and government entities, while stressing that some claims and alleged access remain unverified.
Key points
- REvil publicly named recent ransomware victims and included military-contract information and employee personal data as alleged proof of its attacks.
- The group threatened to share stolen information with foreign military agencies, according to DarkOwl’s account of its announcements.
- DarkOwl says the timing and victim associations challenge the view that REvil selects targets entirely at random, but does not identify the victims.
- The article notes uncertainty about how long ransomware operators may have access to victim networks before deploying encryption and making their presence known.
- A researcher cited in the article said REvil version 2.05 maintained persistence through a Windows Run registry key.
- DarkOwl says claims by a REvil representative about access to national-security assets were unverified, and the representative’s identity may have been impersonated.
- The article describes reported ransomware activity affecting military suppliers, but says one incident was not directly attributed to REvil.
Article Details
- Event Type
- REvil ransomware victim announcements and threats to disclose stolen sensitive data
- Impact
- REvil announced victims and presented military contract information and employees’ personally identifiable information as evidence of attacks, threatening to share the data with foreign military agencies. The article describes potential exposure of critical supply-chain providers and national-security-related organizations, but does not identify the victims or confirm the group’s claimed access to specific national assets. The duration of attackers’ access before ransomware deployment is reported as unknown.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolA separate Pysa/Mespinoza victim analysis described an attack launched through a compromised RDP account, followed by lateral movement.T1547.001 · Registry Run Keys / Startup FolderAnalysis of REvil version 2.05 reportedly found persistence through a Windows Run registry key.
Threat Actors
Malware
Episilon RedREvil fingerprints have also been recently detected in a new strain of ransomware known as Episilon Red, which information security researchers directly associate with a concerted attack on Microsoft Exchange mailMedusaLockerSecurity researchers indicate that Prometheus, operating now for over a month, pens their ransom notes very similar to MountLocker and Medusalocker ransomware variants.MountLockerSecurity researchers indicate that Prometheus, operating now for over a month, pens their ransom notes very similar to MountLocker and Medusalocker ransomware variants.Prometheus ransomware variantIn late May, another new ransomware variant known as Prometheus setup a new Tor onion service claiming they were a “Group of REvil” in their ransom note and branding.Pysa/MespinozaOther ransomware analysis of victims of the Pysa/Mespinoza strain, detailed an 8 hour campaign, launched via a compromised RDP account, where threat actors moved laterally throughout the entire domain harvestingREvilLate last week, DarkOwl analysts observed the REvil ransomware as a service (Raas) cyber-criminal organization publicly announce its latest victims of their ransomware operations on their darknet onion service, some of
Vendors
Citrixon the darknet – and readily prey on unpatched server-side software and remote working products like Citrix ADC.Microsoftstating that persistence of the malware was maintained through creating a registry key under SOFTWARE\Microsoft\Windows\CurrentVersion\Run (on Windows machines), which allows the malware to run every time the user
Products
Industries
Critical infrastructureare indeed directly targeting critical supply-chain targets with unique technological and critical infrastructure focus, instead of indiscriminately targeting victims for monetary gain.Governmentdarknet forum posts stating that they want no part in geopolitical affairs nor act on behalf of any government.Legaltargets, although DarkOwl notes several of their victims over the past year included retail, health, legal, and agricultural companies with operations headquartered in the U.S.MilitaryREvil Threatens to Share Sensitive Victim Data to Foreign Military AgenciesRetailtargets, although DarkOwl notes several of their victims over the past year included retail, health, legal, and agricultural companies with operations headquartered in the U.S.